From a3e78a36778e98634e6ad37ebdbef494aeb6b1bc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:18:52 +0200
Subject: [PATCH] fix(authorization): gate mutable Livewire controls by policy

Disable unauthorized listbox inputs and hide application deploy actions, with updated disabled styling and coverage.
---
 resources/css/app.css                         |  8 +-
 .../components/database-status-info.blade.php |  4 +-
 .../views/components/forms/listbox.blade.php  |  7 ++
 .../livewire/notifications/discord.blade.php  |  2 +-
 .../livewire/notifications/email.blade.php    | 10 +--
 .../project/application/domains.blade.php     |  4 +-
 .../project/application/heading.blade.php     |  4 +
 .../project/application/swarm.blade.php       |  2 +-
 .../database/clickhouse/general.blade.php     |  4 +-
 .../database/dragonfly/general.blade.php      |  4 +-
 .../project/database/heading.blade.php        |  4 +
 .../project/database/keydb/general.blade.php  |  4 +-
 .../database/mariadb/general.blade.php        |  4 +-
 .../database/mongodb/general.blade.php        |  4 +-
 .../project/database/mysql/general.blade.php  |  4 +-
 .../database/postgresql/general.blade.php     |  4 +-
 .../project/database/redis/general.blade.php  |  4 +-
 .../project/service/domains.blade.php         |  4 +-
 .../project/service/heading.blade.php         |  4 +
 .../project/service/stack-form.blade.php      |  2 +-
 .../shared/scheduled-task/show.blade.php      | 10 +--
 .../storages/volume-backups/s3.blade.php      |  4 +-
 .../livewire/server/log-drains.blade.php      |  6 +-
 .../views/livewire/server/swarm.blade.php     |  4 +-
 .../livewire/source/github/change.blade.php   |  4 +-
 .../livewire/source/gitlab/change.blade.php   |  2 +-
 resources/views/livewire/team/index.blade.php |  2 +-
 .../Feature/ListboxTriggerTruncationTest.php  |  9 ++
 ...bleLivewireComponentsAuthorizationTest.php | 83 +++++++++++++++++++
 29 files changed, 164 insertions(+), 47 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 95e0207ce2..636cf2ce8a 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1905,7 +1905,13 @@ html[data-theme="custom"] textarea:disabled {
 
 .listbox-trigger:disabled {
     cursor: not-allowed;
-    opacity: 0.5;
+    background-color: var(--color-neutral-100);
+    color: var(--color-neutral-400);
+}
+
+.dark .listbox-trigger:disabled {
+    background-color: color-mix(in oklab, var(--color-white) 3%, transparent);
+    color: var(--color-fg-faint);
 }
 
 .listbox-trigger:focus-visible {
diff --git a/resources/views/components/database-status-info.blade.php b/resources/views/components/database-status-info.blade.php
index 5e352c206b..b9298e2689 100644
--- a/resources/views/components/database-status-info.blade.php
+++ b/resources/views/components/database-status-info.blade.php
@@ -65,7 +65,7 @@
                 </div>
             @endif
             <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="enableSsl" label="SSL"
+                <x-forms.listbox canGate="update" :canResource="$database" id="enableSsl" label="SSL"
                     onChange="instantSaveSSL"
                     :disabled="! $isExited || ! auth()->user()?->can('update', $database)"
                     :options="[
@@ -73,7 +73,7 @@
                         ['value' => false, 'label' => 'Disabled'],
                     ]" />
                 @if ($sslModeOptions)
-                    <x-forms.listbox id="sslMode" label="SSL mode" :helper="$sslModeHelper"
+                    <x-forms.listbox canGate="update" :canResource="$database" id="sslMode" label="SSL mode" :helper="$sslModeHelper"
                         onChange="instantSaveSSL"
                         :disabled="! $enableSsl || ! $isExited || ! auth()->user()?->can('update', $database)"
                         :options="collect($sslModeOptions)->map(fn ($option, $value) => [
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index 4677911d94..d04a5f57e5 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -16,9 +16,16 @@
     'tooltip' => true,
     'portal' => false,
     'preserveValue' => false,
+    'canGate' => null,
+    'canResource' => null,
+    'autoDisable' => true,
 ])
 
 @php
+    if ($canGate && $canResource && $autoDisable && ! Illuminate\Support\Facades\Gate::allows($canGate, $canResource)) {
+        $disabled = true;
+    }
+
     $triggerId = ($htmlId ?? $id).'-trigger';
     $panelId = ($htmlId ?? $id).'-panel';
 @endphp
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 5fdeb10da9..9e568c8459 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -15,7 +15,7 @@
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="discordPingEnabled" label="Critical event mention"
+                    <x-forms.listbox canGate="update" :canResource="$settings" id="discordPingEnabled" label="Critical event mention"
                         helper="Mention @here when a critical event occurs."
                         onChange="instantSaveDiscordPingEnabled"
                         :disabled="!auth()->user()->can('update', $settings)" :options="[
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index e571d5083f..5ca19e8daa 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -41,7 +41,7 @@
                     <div class="lg:col-span-2">
                         @if (isCloud())
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use hosted email service'],
@@ -50,7 +50,7 @@
                             </div>
                         @else
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use system-wide settings'],
@@ -85,7 +85,7 @@
                     <div class="grid gap-4 lg:grid-cols-3">
                         <div class="lg:col-span-3">
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="smtpEnabled" label="SMTP delivery"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEnabled" label="SMTP delivery"
                                     onChange="submitSmtp"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Enabled'],
@@ -97,7 +97,7 @@
                             placeholder="smtp.mailgun.org" label="Host" />
                         <x-forms.input canGate="update" :canResource="$settings" required id="smtpPort"
                             type="number" placeholder="587" label="Port" />
-                        <x-forms.listbox id="smtpEncryption" label="Encryption" required
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEncryption" label="Encryption" required
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                             ['value' => 'starttls', 'label' => 'StartTLS'],
                             ['value' => 'tls', 'label' => 'TLS / SSL'],
@@ -120,7 +120,7 @@
             <div class="application-settings-form">
                 <x-application.settings-section title="Resend">
                     <div class="grid gap-4 lg:grid-cols-2">
-                        <x-forms.listbox id="resendEnabled" label="Resend delivery"
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="resendEnabled" label="Resend delivery"
                             onChange="submitResend"
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                                 ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index a11e6930f1..4adbcf8ff1 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -71,7 +71,7 @@
 
         @if ($hasHttpsDomains && ! $labelsAreWritable)
             <div class="mt-4 max-w-md">
-                <x-forms.listbox id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
                     onChange="updateForceHttps"
                     helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                     :options="[
@@ -119,7 +119,7 @@
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                                 @if ($isCompose && count($composeServices) > 0)
-                                    <x-forms.listbox label="Service" id="newDomainService" required
+                                    <x-forms.listbox canGate="update" :canResource="$application" label="Service" id="newDomainService" required
                                         :options="collect($composeServices)->map(fn ($serviceName) => [
                                             'value' => $serviceName,
                                             'label' => $serviceName,
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index d7efc8f2fa..3892a623ca 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -39,6 +39,7 @@
 
         <div class="w-full xl:hidden">
             @if (!($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw)))
+                @can('deploy', $application)
                 <div id="application-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -149,6 +150,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
             <div class="hidden" aria-hidden="true">
                 <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
@@ -185,6 +187,7 @@
                         <div class="resource-heading-menus shrink-0">
                             <x-applications.links :application="$application" />
                         </div>
+                        @can('deploy', $application)
                         <div id="application-desktop-actions" class="relative" x-data="{ open: false }"
                             x-effect="$dispatch('resource-actions-toggled', { open })"
                             @click.outside="open = false" @keydown.escape.window="open = false">
@@ -279,6 +282,7 @@
                                 @endif
                             </div>
                         </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/resources/views/livewire/project/application/swarm.blade.php b/resources/views/livewire/project/application/swarm.blade.php
index fc8112afbe..6bd593b933 100644
--- a/resources/views/livewire/project/application/swarm.blade.php
+++ b/resources/views/livewire/project/application/swarm.blade.php
@@ -14,7 +14,7 @@
         <div class="mt-4 grid gap-4 lg:grid-cols-2">
             <x-forms.input id="swarmReplicas" label="Replicas" required canGate="update"
                 :canResource="$application" />
-            <x-forms.listbox id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
+            <x-forms.listbox canGate="update" :canResource="$application" id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
                 :disabled="! auth()->user()->can('update', $application)" :options="[
                     ['value' => true, 'label' => 'Worker nodes only'],
                     ['value' => false, 'label' => 'Manager and worker nodes'],
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index 33486f8e0d..1a83934c8d 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -79,7 +79,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -94,7 +94,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index 8dabe8c9aa..592396c0ae 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -80,7 +80,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -95,7 +95,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index c36020ee9a..bcdf1cf855 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -69,6 +69,7 @@
 
         <div class="w-full xl:hidden">
             @if ($database->destination->server->isFunctional())
+                @can('manage', $database)
                 <div id="database-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -127,6 +128,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
 
         </div>
@@ -137,6 +139,7 @@
                 class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 items-center justify-end gap-1 overflow-visible">
                 <div class="resource-heading-actions flex shrink-0 items-center gap-0.5">
                     @if ($database->destination->server->isFunctional())
+                        @can('manage', $database)
                         <div id="database-desktop-actions" class="flex items-center gap-0.5">
                             @if (! $databaseStatus->startsWith('exited'))
                                 <button type="button" class="button button-highlighted"
@@ -156,6 +159,7 @@
                                 </x-forms.button>
                             @endif
                         </div>
+                        @endcan
                     @else
                         <x-status-badge status="Server unavailable" type="error" />
                     @endif
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index e6b7ff985f..6d894df04b 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -81,7 +81,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index a604bb700a..f2df51f661 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 62d57910a5..ac47d8d69f 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -83,7 +83,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index e2cd3802ed..7f7b40085d 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 705cad4412..738c46fea9 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -90,7 +90,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave" :onChangeArgs="[]"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -111,7 +111,7 @@
 
         <x-application.settings-section id="log-delivery-section" title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index 39fa2c8522..3fdf256190 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -85,7 +85,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -110,7 +110,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 9399efe7f9..05e5792fe2 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -93,7 +93,7 @@
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -170,7 +170,7 @@
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="forceHttpsRedirects.{{ $appId }}"
+                                <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
                                     htmlId="service-force-https-{{ $appId }}"
                                     label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 113a6c5a3f..b022eef10c 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -73,6 +73,7 @@
 
         <div class="w-full xl:hidden">
             @if ($service->isDeployable)
+                @can('deploy', $service)
                 <div id="service-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -165,6 +166,7 @@
                         @endif
                     </div>
                 </div>
+                @endcan
             @else
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                     class="mb-3 inline-flex" aria-label="Open required environment variables">
@@ -183,6 +185,7 @@
                         <div class="resource-heading-menus shrink-0">
                             <x-services.links :service="$service" />
                         </div>
+                        @can('deploy', $service)
                         <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
                                 x-effect="$dispatch('resource-actions-toggled', { open })"
                                 @click.outside="open = false" @keydown.escape.window="open = false">
@@ -247,6 +250,7 @@
                                     @endif
                                 </div>
                         </div>
+                        @endcan
                     @else
                         <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                             aria-label="Open required environment variables">
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index d6c55ecfe3..423ea0aaf8 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -52,7 +52,7 @@
 
     <x-application.settings-section title="Network"
         description="Control whether this Compose stack joins Coolify's predefined network.">
-        <x-forms.listbox id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
+        <x-forms.listbox canGate="update" :canResource="$service" id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
             :disabled="! auth()->user()->can('update', $service)" :options="[
                 ['value' => false, 'label' => 'Use the stack network only'],
                 ['value' => true, 'label' => 'Connect to the predefined Coolify network'],
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index dcf90fd2ee..c5be9974ba 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -27,21 +27,21 @@
             </x-slot:actions>
 
             <div class="grid gap-4 md:grid-cols-2">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
                     label="Name" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="0 0 * * * or daily" id="frequency" label="Schedule"
                     helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression."
                     required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" type="number"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" type="number"
                     placeholder="300" id="timeout" helper="Maximum execution time from 60 to 36,000 seconds."
                     label="Timeout (seconds)" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
                     helper="Leave empty when the resource only has one container." id="container"
                     label="{{ $type === 'service' ? 'Service' : 'Container' }}" />
             </div>
             <div class="mt-4">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="php artisan schedule:run" id="command" label="Command" required />
             </div>
         </x-application.settings-section>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index 2dc32b3e31..eeaca78479 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -39,13 +39,13 @@
                 @endif
             </div>
             <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveToS3"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageId" label="S3 storage" :required="$saveToS3"
                     :disabled="! auth()->user()?->can('update', $resource)"
                     :options="$availableS3Storages->map(fn ($s3Storage) => [
                         'value' => $s3Storage->id,
                         'label' => $s3Storage->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
                     :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
diff --git a/resources/views/livewire/server/log-drains.blade.php b/resources/views/livewire/server/log-drains.blade.php
index 66f7985032..ac908a7c9d 100644
--- a/resources/views/livewire/server/log-drains.blade.php
+++ b/resources/views/livewire/server/log-drains.blade.php
@@ -29,7 +29,7 @@
                     <x-application.settings-section id="server-new-relic-drain-section" title="New Relic"
                         helper="Send logs through the New Relic Log API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainNewRelicEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainNewRelicEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -48,7 +48,7 @@
                     <x-application.settings-section id="server-axiom-drain-section" title="Axiom"
                         helper="Send logs to an Axiom dataset using its ingest API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainAxiomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainAxiomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -65,7 +65,7 @@
                     <x-application.settings-section id="server-custom-drain-section" title="Custom Fluent Bit"
                         helper="Provide a custom Fluent Bit output and optional parser configuration.">
                         <div class="mb-4 max-w-sm">
-                            <x-forms.listbox id="isLogDrainCustomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainCustomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/server/swarm.blade.php b/resources/views/livewire/server/swarm.blade.php
index 8d807fcc5b..a3e8dfce4a 100644
--- a/resources/views/livewire/server/swarm.blade.php
+++ b/resources/views/livewire/server/swarm.blade.php
@@ -23,14 +23,14 @@
                 </x-callout>
 
                 <div class="mt-4 grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="isSwarmManager" label="Manager role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmManager" label="Manager role"
                         helper="Managers control scheduling and cluster state." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm manager'],
                             ['value' => true, 'label' => 'Swarm manager'],
                         ]"
                         :disabled="$server->settings->is_swarm_worker || !auth()->user()->can('update', $server)" />
-                    <x-forms.listbox id="isSwarmWorker" label="Worker role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmWorker" label="Worker role"
                         helper="Workers run tasks assigned by a Swarm manager." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm worker'],
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 5cafb3edb3..2730c19a97 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -127,7 +127,7 @@
 
                                         @if (!isCloud())
                                             <div class="lg:col-span-2">
-                                                <x-forms.listbox id="isSystemWide" label="Availability" :options="[
+                                                <x-forms.listbox canGate="update" :canResource="$github_app" id="isSystemWide" label="Availability" :options="[
                                                     ['value' => false, 'label' => 'Only this team'],
                                                     ['value' => true, 'label' => 'Every team on this instance'],
                                                 ]"
@@ -161,7 +161,7 @@
                                             label="Client secret" type="password" required />
                                         <x-forms.input canGate="update" :canResource="$github_app" id="webhookSecret"
                                             label="Webhook secret" type="password" required />
-                                        <x-forms.listbox id="privateKeyId" label="Private key" required
+                                        <x-forms.listbox canGate="update" :canResource="$github_app" id="privateKeyId" label="Private key" required
                                             :options="$privateKeyOptions" :disabled="!auth()->user()->can('update', $github_app)" />
                                     </div>
                                 </x-application.settings-section>
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index a8a499e6ba..5629e1e364 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -82,7 +82,7 @@
                     <x-forms.input canGate="update" :canResource="$gitlab_app" type="number" id="customPort"
                         label="SSH port" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="privateKeyId" label="SSH private key (optional)"
+                        <x-forms.listbox canGate="update" :canResource="$gitlab_app" id="privateKeyId" label="SSH private key (optional)"
                             :options="collect($privateKeys)->map(fn ($key) => [
                                 'value' => $key->id,
                                 'label' => $key->name,
diff --git a/resources/views/livewire/team/index.blade.php b/resources/views/livewire/team/index.blade.php
index 64fe0994a4..d30df3411d 100644
--- a/resources/views/livewire/team/index.blade.php
+++ b/resources/views/livewire/team/index.blade.php
@@ -18,7 +18,7 @@
                     <x-forms.input id="name" label="Name" required canGate="update" :canResource="$team" />
                     <x-forms.input id="description" label="Description" canGate="update" :canResource="$team" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="is_mcp_server_enabled" label="MCP server"
+                        <x-forms.listbox canGate="update" :canResource="$team" id="is_mcp_server_enabled" label="MCP server"
                             helper="Controls whether this team's API tokens can use the instance MCP endpoint."
                             :disabled="! auth()->user()->can('update', $team)" :options="[
                                 ['value' => false, 'label' => 'Disabled for this team'],
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index d5f259a853..82e526bb3b 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,6 +22,15 @@ test('listbox trigger height matches shared inputs', function () {
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
+test('disabled listboxes use the same colors as disabled inputs', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\.listbox-trigger:disabled \{[^}]*background-color: var\(--color-neutral-100\);[^}]*color: var\(--color-neutral-400\);/s')
+        ->toMatch('/\.dark \.listbox-trigger:disabled \{[^}]*background-color: color-mix\(in oklab, var\(--color-white\) 3%, transparent\);[^}]*color: var\(--color-fg-faint\);/s')
+        ->not->toMatch('/\.listbox-trigger:disabled \{[^}]*opacity:/s');
+});
+
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index ffaefa8635..f6991025c8 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -1,9 +1,58 @@
 <?php
 
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Gate;
 
 uses(RefreshDatabase::class);
 
+it('auto-disables listboxes when the gate denies access', function () {
+    Gate::define('update-listbox-test', fn (): bool => false);
+
+    $html = Blade::render(<<<'BLADE'
+        <x-forms.listbox id="status" :wire="false" value="enabled"
+            canGate="update-listbox-test" :canResource="new stdClass"
+            :options="[['value' => 'enabled', 'label' => 'Enabled']]" />
+    BLADE);
+
+    expect($html)->toMatch('/<button[^>]*id="status-trigger"[^>]*\sdisabled(?:[=\s>])/');
+});
+
+it('declares gate attributes on form controls with update permission checks', function () {
+    $controlPattern = '/<x-forms\.(?:listbox|input|select|checkbox|textarea|button|toggle)\b.*?(?:\/>|<\/x-forms\.[^>]+>)/s';
+
+    foreach (File::allFiles(resource_path('views')) as $file) {
+        $path = $file->getPathname();
+        $source = file_get_contents($path);
+        preg_match_all($controlPattern, $source, $controls);
+
+        foreach ($controls[0] as $control) {
+            if (! preg_match('/can\(\s*[\'\"]update[\'\"]/', $control)) {
+                continue;
+            }
+
+            expect($control, $path)->toContain('canGate="update"')
+                ->toContain(':canResource=');
+        }
+    }
+});
+
+it('hides resource action menus when the user cannot manage the resource', function (string $path, string $ability, string $resource, string $prefix) {
+    $source = file_get_contents(resource_path($path));
+
+    foreach (['mobile', 'desktop'] as $viewport) {
+        expect($source)->toMatch(
+            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<div id=\"{$prefix}-{$viewport}-actions\"/"
+        );
+    }
+})->with([
+    'application actions' => ['views/livewire/project/application/heading.blade.php', 'deploy', 'application', 'application'],
+    'service actions' => ['views/livewire/project/service/heading.blade.php', 'deploy', 'service', 'service'],
+    'database actions' => ['views/livewire/project/database/heading.blade.php', 'manage', 'database', 'database'],
+    'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
+]);
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
@@ -69,4 +118,38 @@ it('authorizes every volume backup form control', function (string $path, array
             '/wire:click="checkAllDns"/s',
         ],
     ],
+    'postgres public access control' => [
+        'resources/views/livewire/project/database/postgresql/general.blade.php',
+        [
+            '/<x-forms\.listbox id="isPublic"[\s\S]*?:disabled="! auth\(\)->user\(\)->can\(\'update\', \$database\)" canGate="update" :canResource="\$database" :options=/',
+        ],
+    ],
+    'redis public access control' => [
+        'resources/views/livewire/project/database/redis/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mongodb public access control' => [
+        'resources/views/livewire/project/database/mongodb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'clickhouse public access control' => [
+        'resources/views/livewire/project/database/clickhouse/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mariadb public access control' => [
+        'resources/views/livewire/project/database/mariadb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'dragonfly public access control' => [
+        'resources/views/livewire/project/database/dragonfly/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mysql public access control' => [
+        'resources/views/livewire/project/database/mysql/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'keydb public access control' => [
+        'resources/views/livewire/project/database/keydb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
 ]);